QueueOps

local cfg = redis.call('HMGET', K_CFG, 'status', 'queueOpensAt', 'saleOpensAt', 'capacity', 'maxPerClientKey', 'expiresAt')
if not cfg[1] then return { 'err', 'room_not_found' } end
if cfg[1] ~= 'active' then return { 'err', 'room_closed' } end
if now < tonumber(cfg[2]) then return { 'err', 'room_not_open' } end
local sale_opens_at, expires_at = tonumber(cfg[3]), cfg[6]

local created = 0
local vid = redis.call('HGET', K_SUBJECTS, subject)
local state

if vid then
  local raw = redis.call('HGET', K_VISITORS, vid)
  state = raw and parse_visitor(raw) or 'l'
  redis.call('HSET', K_VISITORS, vid, visitor_value(state, nonce, subject))
else
  if redis.call('HLEN', K_SUBJECTS) >= tonumber(cfg[4]) then return { 'err', 'room_full' } end
  if cfg[5] ~= '' and tonumber(redis.call('HGET', K_CLIENTS, client_key) or '0') >= tonumber(cfg[5]) then
    return { 'err', 'client_limit' }
  end

  local score = random_score
  if now >= sale_opens_at then score = LATE_BASE + redis.call('INCR', K_SEQ) end

  vid, state, created = fresh_vid, 'w', 1
  redis.call('HSET', K_SUBJECTS, subject, vid)
  redis.call('HINCRBY', K_CLIENTS, client_key, 1)
  redis.call('HSET', K_VISITORS, vid, visitor_value(state, nonce, subject))
  redis.call('ZADD', K_QUEUE, score, vid)
  expire_with_room(expires_at, K_SUBJECTS, K_CLIENTS, K_VISITORS, K_QUEUE, K_SEQ)
end

-- 1. Admissions whose time is up give their slot back. The visitor's place stays spent.
local ran_out = redis.call('ZRANGEBYSCORE', K_ACTIVE, '-inf', now, 'LIMIT', 0, batch)
for _, vid in ipairs(ran_out) do
  local raw = redis.call('HGET', K_VISITORS, vid)
  if raw then
    local state, nonce, subject = parse_visitor(raw)
    if string.sub(state, 1, 2) == 'a:' then redis.call('HSET', K_VISITORS, vid, visitor_value('x', nonce, subject)) end
  end
  redis.call('ZREM', K_ACTIVE, vid)
end

-- 2. Free slots go to the front of the queue, lowest score first.
local admitted = 0
local free = tonumber(cfg[3]) - redis.call('ZCARD', K_ACTIVE)
if free > 0 then
  local admitted_until = now + tonumber(cfg[4]) * 1000
  local popped = redis.call('ZPOPMIN', K_QUEUE, math.min(free, batch))
  for i = 1, #popped, 2 do
    local vid = popped[i]
    local raw = redis.call('HGET', K_VISITORS, vid)
    if raw then
      local _, nonce, subject = parse_visitor(raw)
      redis.call('ZADD', K_ACTIVE, admitted_until, vid)
      redis.call('HSET', K_VISITORS, vid, visitor_value('a:' .. int(admitted_until), nonce, subject))
      admitted = admitted + 1
    end
  end

/**
 * A pre-sale join's place in the order: uniform over [0, 2^48), from the CSPRNG. Independent uniform keys sort into
 * a uniformly random order, and 2^48 makes a tie (which Redis would break by visitor id) vanishingly rare. Every
 * score stays exact in a double (below 2^53), in Lua and in the sorted set. Six CSPRNG bytes are exactly that range
 * (`crypto.randomInt` refuses a span of 2^48).
 */
export const randomScore = (): number => randomBytes(6).readUIntBE(0, 6);

/**
 * How long a visitor should wait before polling again (PLAN "Fairness, consistency and the capacity limit"):
 * about 30 s before the sale, about 3 s near the front, 10–15 s further back, each ±20 %.
 *
 * A pre-sale visitor whose next poll would come after the sale opens is told to come back just after it opens
 * instead, spread over `SALE_OPEN_SPREAD_MS`, so the crowd sees its positions soon but not all in the same second.
 */
export const pollAfterMs = (
  view: VisitorView,
  room: { readonly maxActive: number; readonly msUntilSale: number },
  random: () => number = Math.random,
): number => {
  let ms: number;
  switch (view.state) {
    case 'pre_sale': {
      ms = jitter(PRE_SALE_POLL_MS, random);
      if (room.msUntilSale < ms) ms = Math.max(room.msUntilSale, 0) + SALE_OPEN_SPREAD_MS * random();
      break;
    }
    case 'waiting': {
      const near = view.position !== null && view.position <= 2 * room.maxActive;
      ms = jitter(near ? NEAR_FRONT_POLL_MS : FAR_POLL_MIN_MS + (FAR_POLL_MAX_MS - FAR_POLL_MIN_MS) * random(), random);
      break;
    }
    case 'admitted':
      ms = jitter(ADMITTED_POLL_MS, random);
      break;
    default:
      ms = jitter(SETTLED_POLL_MS, random);
  }
  return Math.max(Math.round(ms), MIN_POLL_GAP_MS);
};

  async sign(admission: Admission): Promise<{ token: string; kid: string }> {
    const { kid, privateKey } = await this.key(admission.accountId);
    const token = await new SignJWT({ room: admission.roomId })
      .setProtectedHeader({ alg: 'ES256', typ: 'JWT', kid })
      .setIssuer(ADMISSION_ISSUER)
      .setAudience(admission.accountId)
      .setSubject(admission.subject)
      .setJti(admission.visitorId)
      // Rounded down: the token never outlives the admission.
      .setExpirationTime(Math.floor(admission.admittedUntil / 1000))
      .sign(privateKey);
    return { token, kid };
  }

  /** The claims, or null for anything that is malformed, forged or expired. */
  verify(token: string | null): VisitorClaims | null {
    if (!token || token.length > MAX_VISITOR_TOKEN_LENGTH || !TOKEN_SHAPE.test(token)) return null;
    const [body, signature] = token.split('.') as [string, string];
    const given = Buffer.from(signature, 'base64url');
    if (!this.secrets.some(secret => timingSafeEqual(this.mac(secret, body), given))) return null;

    let claims: unknown;
    try {
      claims = JSON.parse(Buffer.from(body, 'base64url').toString('utf8'));
    } catch {
      return null;
    }
    if (!isClaims(claims) || claims.exp * 1000 <= this.now()) return null;
    return { acct: claims.acct, room: claims.room, vid: claims.vid, nonce: claims.nonce, exp: claims.exp };
  }